tests to use certificates in order to ensure the tests are run

  properly and in full.

At time of this writing, Gimmecert is compatible with the following

Python versions:

- *Python 3.8*

Why was this tool created?

--------------------------

The tool was created to remove the pain of setting-up a CA hierarchy,

# All Vagrant configuration is done below. The "2" in Vagrant.configure

# configures the configuration version (we support older styles for

# backwards compatibility). Please don't change it unless you know what

# you're doing.

Vagrant.configure("2") do |config|

  config.vm.hostname = "gimmecert-testing"

  config.vm.provision "shell", path: "provision.sh"

end

<https://virtualenvwrapper.readthedocs.io/>`_. Instructions have been

tailored for a GNU/Linux system.

Before proceeding, ensure you have the following system-wide packages

installed:

- `virtualenvwrapper <https://virtualenvwrapper.readthedocs.io/>`_.

With those in place, do the following:

1. Clone the git repository::

  tox

  # List available tox environments.

  tox -l

  # Run tests against specific Python version.

  # Run documentation and linting tests only.

  tox -e doc,lint

Running tests on all supproted Python versions

Installation

============

Gimmecert can be easily installed using ``pip``. Before installing it,

make sure the following requirements have been met:

In order to install latest stable release of *Gimmecert* using *pip*, run the

following command::

  pip install gimmecert

=============

NEXT RELEASE

------------

0.5.0

-----

This release adds support for Python 3.9, and updates the package

requirements.

# You should have received a copy of the GNU General Public License along with

# Gimmecert.  If not, see <http://www.gnu.org/licenses/>.

#

import io

import subprocess

import pexpect

def run_command(command, *args):

    :rtype: (str, str, int)

    """

    invocation = [command]

    invocation.extend(args)

    stdout, stderr = process.communicate()

    stdout, stderr = stdout.decode(), stderr.decode()

    return stdout, stderr, process.returncode

    :rtype: (str or None, str, int)

    """

    # Assume that all prompts/answers worked as expected.

    failure = None

    # Spawn the process, use dedicated stream for capturin command

    # stdout/stderr.

    output_stream = io.StringIO()

    send_stream = io.StringIO()

    process = pexpect.spawnu(command, list(args), timeout=4)

    process.logfile_read = output_stream

    stdout, stderr, exit_code = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/client/myclient.key.pem')

    # No errors are reported, and John is able to see some details

    # about the generated key.

    assert exit_code == 0

    assert stderr == ""

    # John then has a look at the generated certificate file.

    stdout, stderr, exit_code = run_command('openssl', 'x509', '-noout', '-text', '-in', '.gimmecert/client/myclient.cert.pem')

    # Once again, there are no errors, and he can see some details

    # about the certificate.

    stdout, stderr, exit_code = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/ca/level1.key.pem')

    # No errors are reported, and John is able ot see some details

    # about the generated key.

    assert exit_code == 0

    assert stderr == ""

    # John then has a look at the generated certificate file.

    stdout, stderr, exit_code = run_command('openssl', 'x509', '-noout', '-text', '-in', '.gimmecert/ca/level1.cert.pem')

    # With no errors again, he can see some of the details in

    # certificate.

    stdout1, stderr1, exit_code1 = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/ca/level1.key.pem')

    stdout2, stderr2, exit_code2 = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/ca/level2.key.pem')

    stdout3, stderr3, exit_code3 = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/ca/level3.key.pem')

    assert exit_code1 == 0

    assert stderr1 == ""

    assert exit_code2 == 0

    assert stderr2 == ""

    assert exit_code3 == 0

    assert stderr3 == ""

    # John then has a look at the generated CA certificate files.

    stdout1, stderr1, exit_code1 = run_command('openssl', 'x509', '-noout', '-text', '-in', '.gimmecert/ca/level1.cert.pem')

    stdout2, stderr2, exit_code2 = run_command('openssl', 'x509', '-noout', '-text', '-in', '.gimmecert/ca/level2.cert.pem')

    stdout3, stderr3, exit_code3 = run_command('openssl', 'x509', '-noout', '-text', '-in', '.gimmecert/ca/level3.cert.pem')

    # John goes ahead and inspects the CA private key to ensure his

    # private key specification has been accepted.

    stdout, stderr, exit_code = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/ca/level1.key.pem')

    assert exit_code == 0

    assert stderr == ""

    # John also does a quick check on the generated certificate's

    # signing and public key algorithm.

    stdout, stderr, exit_code = run_command('openssl', 'x509', '-noout', '-text', '-in', '.gimmecert/ca/level1.cert.pem')

    assert exit_code == 0

    # He runs a command to see details about the generated private

    # key.

    stdout, _, _ = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/server/myserver1.key.pem')

    # He can see that the generated private key uses the same size as the

    # one he specified for the CA hierarchy.

def test_server_command_key_specification_with_rsa(tmpdir):

    # John is working on a project where he has already initialised CA

    # hierarchy using strong RSA keys. However, now he has a need to

    # issue a couple of weaker RSA keys for performance testing.

    # He runs a command to see details about the generated private

    # key.

    stdout, _, _ = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/server/myserver1.key.pem')

    # He nods with his head, observing that the generated private key

    # uses the same key size as he has requested.

def test_client_command_default_key_specification_with_rsa(tmpdir):

    # John needs to perform some quick tests revolving around the use

    # of X.509 certificates, but he does not care about the generated

    # private key strength. He primarily needs to deal with

    # He runs a command to see details about the generated private

    # key.

    stdout, _, _ = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/client/myclient1.key.pem')

    # He can see that the generated private key uses the same size as the

    # one he specified for the CA hierarchy.

def test_client_command_key_specification_with_rsa(tmpdir):

    # John is working on a project where he has already initialised CA

    # hierarchy using strong RSA keys. However, now he has a need to

    # issue a couple of weaker RSA keys for performance testing.

    # He runs a command to see details about the generated private

    # key.

    stdout, _, _ = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/client/myclient1.key.pem')

    # He nods with his head, observing that the generated private key

    # uses the same key size as he has specified.

def test_renew_command_key_specification_with_rsa(tmpdir):

    # John has set-up a project where he has issued a couple of

    # certificates. For some of them he has used externally-generated

    # private keys.

    assert stderr == ""

    # He checks the details about the generated private key, and

    # disovers that Gimmecert generated the key according to his

    # wishes.

    stdout, _, _ = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/server/myserver1.key.pem')

    # John goes ahead and performs a similar operation for his client

    # entity.

    stdout, stderr, exit_code = run_command("gimmecert", "renew", "client", "-k", "rsa:1024", "-p", "myclient1")

    assert exit_code == 0

    assert stderr == ""

    # And once again, Gimmecert has created the key with correct size.

    stdout, _, _ = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/client/myclient1.key.pem')

    # After some further testing, John decides to renew the

    # certificates that have been issued using a CSR. He requests new

    # private keys to be generated as well.

    stdout, stderr, exit_code = run_command("gimmecert", "renew", "server", "-p", "myserver1")

    assert exit_code == 0

    # John is unsure if the same key specification has been used. So

    # he goes ahead and has a look at the server key.

    stdout, _, _ = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/server/myserver1.key.pem')

    # The renew command has used the same key specification for the

    # new private key as for the old private key.

    # He performs the same check on the client key.

    stdout, _, _ = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/client/myclient1.key.pem')

    # The renew command has used the same key specification for the

    # new private key as for the old private key.

    # After using his manually generated private keys for a while,

    # John accidentally deletes them from his managed machine. Instead

    # of redoing the whole process with CSRs, he decides to simply

    # regenerate the private keys and certificates and copy them over.

    run_command('gimmecert', 'renew', 'server', '--new-private-key', 'myserver2')

    # hierarchy defaults, or the same key size he used when generating

    # the keys manually.

    #

    # He checks the server private key, and everything seems right -

    # same key size is used as in case of the old private key.

    stdout, stderr, _ = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/server/myserver2.key.pem')

    # Then he has a look at the client private key, and that one is

    # also using the same key size as the old private key.

    stdout, _, _ = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/client/myclient2.key.pem')

def test_initialisation_with_ecdsa_key_specification(tmpdir):

    # John wnats to initialise a CA hierarchy using ECDSA keys. He

    # switches to his project directory.

    tmpdir.chdir()

    stdout, stderr, exit_code = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/server/myserver.key.pem')

    # No errors are reported, and John is able to see some details

    # about the generated key.

    assert exit_code == 0

    assert stderr == ""

    # John then has a look at the generated certificate file.

    stdout, stderr, exit_code = run_command('openssl', 'x509', '-noout', '-text', '-in', '.gimmecert/server/myserver.cert.pem')

    # Once again, there are no errors, and he can see some details

    # about the certificate.

apt-get update -qq

# Install development tools.

apt-get install -qq -y git virtualenv

# Install Python build dependencies.

# Import public keys for validating Python releases.

sudo -i -u vagrant gpg -q --import /vagrant/provision/python_releases_signing_keys.pub

# Download and build additional Python versions.

work_directory="/home/vagrant/src"

echo "Setting-up work directory."

sudo -i -u vagrant mkdir -p "$work_directory"

for version in "${python_versions[@]}"; do